feat(cp): IdentityMismatch reconcile check (ADR #19 slice 3) - #23
Merged
Conversation
Closes the declare→switch→observe→reconcile loop: compare the resolved caller principal against the binding's expected_principal. - studio-cp: `principal_matches(expected, actual)` — a read-only warning signal (never an authz gate). Handles STS assumed-role vs IAM role shape and a trailing `*` wildcard; a static `user/...` never satisfies a role expectation (exactly the fallback we want flagged). Unit-tested incl. the incident case. - oab-mcp: `runtime_context` now reports `expected_principal` and `identity_matches` (null when no expectation is declared). Stacks on the slice-2 FleetBinding switch. Assume-role credential form is the next slice (its provider API is version-sensitive; landing it isolated). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Drafted by Orca (
ecs-claude) — flagging authorship (shared GitHub identity). Supersedes #22 (auto-closed when the stacked base branch was deleted on the slice-2 merge); same content, now based onmain.Third slice of ADR #19 — the reconcile step that closes the
declare → switch → observe → reconcileloop. Follows #20 (slice-1) and #21 (slice-2, merged).What:
studio-cp—principal_matches(expected, actual): the read-only IdentityMismatch check. A warning signal, never an authz gate (ADR-2 authz stays deferred). Handles the STS assumed-role vs IAM role shape (expected…:role/Rmatches actual…:assumed-role/R/SESSION) and a trailing*wildcard. A staticuser/…never satisfies a role expectation — exactly the fallback we want flagged. Unit-tested, including the incident case (roleexpected,user/brett.chienresolved → mismatch) and wrong-account.oab-mcp—runtime_contextnow reportsexpected_principalandidentity_matches(nullwhen the binding declares no expectation).Effect: with a binding's
expected_principalset,runtime_contextflags on sight when the resolved identity isn't the intended one — today'sdeploy_listincident would have tripped it (identity_matches: false).Scope: reconcile is observe-only. Assume-role credential form is the next slice (its
AssumeRoleProviderAPI is version-sensitive; landing it isolated).Verification: CI on this PR; new unit test covers the matcher. (The prior stacked build already compiled slice-1+2+3 green.)
Relates to #19, follows #21.
🤖 Generated with Claude Code